{"id":103407,"date":"2022-02-22T03:36:42","date_gmt":"2022-02-22T01:36:42","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/vypusk-paketnogo-filtra-nftables-1-0-2"},"modified":"2022-02-22T03:36:42","modified_gmt":"2022-02-22T01:36:42","slug":"vypusk-paketnogo-filtra-nftables-1-0-2","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sk\/blog\/news\/vypusk-paketnogo-filtra-nftables-1-0-2","title":{"rendered":"Vydanie bal\u00edkov\u00e9ho filtra nftables 1.0.2","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>Bol vydan\u00fd bal\u00ed\u010dkov\u00fd filter nftables 1.0.2, ktor\u00fd unifikuje rozhrania filtr\u00e1cie paketov pre IPv4, IPv6, ARP a sie\u0165ov\u00e9 mosty (cielen\u00fd na nahradenie iptables, ip6tables, arptables a ebtables). Nevyhnutn\u00e9 zmeny pre fungovanie vydania nftables 1.0.2 s\u00fa zahrnut\u00e9 v jadre Linux 5.17-rc.      <\/p>\n<p>Bal\u00edk nftables zah\u0155\u0148a komponenty bal\u00edkov\u00e9ho filtra pracuj\u00face v u\u017e\u00edvate\u013eskom priestore, zatia\u013e \u010do na \u00farovni jadra zabezpe\u010duje \u010dinnos\u0165 subsyst\u00e9m nf_tables, ktor\u00fd je s\u00fa\u010das\u0165ou jadra Linux od verzie 3.13. Na \u00farovni jadra je poskytovan\u00e9 iba v\u0161eobecn\u00e9 rozhranie, nez\u00e1visl\u00e9 od konkr\u00e9tneho protokolu a poskytuj\u00face z\u00e1kladn\u00e9 funkcie na z\u00edskavanie \u00fadajov z paketov, vykon\u00e1vanie oper\u00e1ci\u00ed s \u00fadajmi a riadenie toku.    <\/p>\n<p>Pravidl\u00e1 filtr\u00e1cie a \u0161pecifick\u00e9 spracovate\u013esk\u00e9 moduly pre protokoly s\u00fa kompilovan\u00e9 do bajtk\u00f3du v u\u017e\u00edvate\u013eskom priestore, po \u010dom je tento bajtk\u00f3d na\u010d\u00edtan\u00fd do jadra pomocou rozhrania Netlink a vykon\u00e1va sa v jadre na \u0161peci\u00e1lnom <a class=\"wpil_keyword_link\" href=\"https:\/\/prohoster.info\/sk\/vps\/abuzoustojchivye-vps\/\"   title=\"virtu\u00e1lnom stroji\" data-wpil-keyword-link=\"linked\"  data-wpil-monitor-id=\"4319\">virtu\u00e1lnom stroji<\/a>, pripom\u00ednaj\u00facom BPF (Berkeley Packet Filters). Tak\u00fdto pr\u00edstup umo\u017e\u0148uje v\u00fdznamne zn\u00ed\u017ei\u0165 ve\u013ekos\u0165 k\u00f3du filtr\u00e1cie, ktor\u00fd funguje na \u00farovni jadra a prenies\u0165 v\u0161etky funkcie parsovania pravidiel a logiky pr\u00e1ce s protokolmi do u\u017e\u00edvate\u013esk\u00e9ho priestoru.    <\/p>\n<p>Hlavn\u00e9 novinky:  <\/p>\n<ul>\n<li class=\"l\"> Pridan\u00e1 je optimaliz\u00e1cia pravidiel, ktor\u00fa je mo\u017en\u00e9 aktivova\u0165 pomocou novej mo\u017enosti &#171;-o&#187; (&#171;&#8212;optimize&#187;). T\u00fato mo\u017enos\u0165 m\u00f4\u017eete kombinova\u0165 s vo\u013ebou &#171;&#8212;check&#187; na kontrolu a optimaliz\u00e1ciu zmien v s\u00fabore s pravidlami bez jeho skuto\u010dn\u00e9ho na\u010d\u00edtania. Optimaliz\u00e1cia umo\u017e\u0148uje zl\u00fa\u010di\u0165 podobn\u00e9 pravidl\u00e1, napr\u00edklad pravidl\u00e1:          meta iifname eth1 ip saddr 1.1.1.1 ip daddr 2.2.2.3 accept        meta iifname eth1 ip saddr 1.1.1.2 ip daddr 2.2.2.5 accept        ip saddr 1.1.1.1 ip daddr 2.2.2.2 accept        ip saddr 2.2.2.2 ip daddr 3.3.3.3 drop\n<p>bud\u00fa zl\u00fa\u010den\u00e9 do           meta iifname . ip saddr . ip daddr { eth1 . 1.1.1.1 . 2.2.2.3, eth1 .   1.1.1.2 . 2.2.2.5 } accept        ip saddr . ip daddr vmap { 1.1.1.1 . 2.2.2.2 : accept, 2.2.2.2 . 3.3.3.3   : drop }    <\/p>\n<p>Pr\u00edklad pou\u017eitia:       # nft -c -o -f ruleset.test     Merging:       ruleset.nft:16:3-37:  ip daddr 192.168.0.1 counter accept       ruleset.nft:17:3-37:  ip daddr 192.168.0.2 counter accept       ruleset.nft:18:3-37:  ip daddr 192.168.0.3 counter accept     do:       ip daddr { 192.168.0.1, 192.168.0.2, 192.168.0.3 } counter packets 0 bytes 0 accept      <\/p>\n<li class=\"l\"> V set-zoznamoch bola implementovan\u00e1 mo\u017enos\u0165 ur\u010di\u0165 ip- a tcp-vo\u013eby, ako aj chunk-y sctp:            set s5 {                 typeof ip option ra value                 elements = { 1, 1024 }          }            set s7 {                 typeof sctp chunk init num-inbound-streams                 elements = { 1, 4 }          }            chain c5 {                 ip option ra value @s5 accept          }            chain c7 {                 sctp chunk init num-inbound-streams @s7 accept          }\n<li class=\"l\"> Bola pridan\u00e1 podpora TCP-vo\u013eieb fastopen, md5sig a mptcp.\n<li class=\"l\"> Bola pridan\u00e1 podpora pou\u017e\u00edvania v porovn\u00e1vaniach podtypu mp-tcp:            tcp option mptcp subtype 1\n<li class=\"l\"> Zlep\u0161en\u00fd k\u00f3d filtr\u00e1cie, ktor\u00fd pracuje na strane jadra.\n<li class=\"l\"> Pre flowtable bola implementovan\u00e1 pln\u00e1 podpora form\u00e1tu JSON.\n<li class=\"l\"> Zaveden\u00e1 je mo\u017enos\u0165 pou\u017e\u00edva\u0165 akciu &#171;reject&#187; v oper\u00e1ci\u00e1ch porovn\u00e1vania Ethernetov\u00fdch r\u00e1mcov.            ether saddr aa:bb:cc:dd:ee:ff ip daddr 192.168.0.1 reject      <\/ul>\n<p>Zdroj: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=56739\">opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d \u0432\u044b\u043f\u0443\u0441\u043a \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u0433\u043e \u0444\u0438\u043b\u044c\u0442\u0440\u0430 nftables 1.0.2, \u0443\u043d\u0438\u0444\u0438\u0446\u0438\u0440\u0443\u044e\u0449\u0435\u0433\u043e \u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441\u044b \u0444\u0438\u043b\u044c\u0442\u0440\u0430\u0446\u0438\u0438 \u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u0434\u043b\u044f IPv4, IPv6, ARP \u0438 \u0441\u0435\u0442\u0435\u0432\u044b\u0445 \u043c\u043e\u0441\u0442\u043e\u0432 (\u043d\u0430\u0446\u0435\u043b\u0435\u043d \u043d\u0430 \u0437\u0430\u043c\u0435\u043d\u0443 iptables, ip6table, arptables \u0438 ebtables). \u041d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u044b\u0435 \u0434\u043b\u044f \u0440\u0430\u0431\u043e\u0442\u044b \u0432\u044b\u043f\u0443\u0441\u043a\u0430 nftables 1.0.2 \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u044f \u0432\u043a\u043b\u044e\u0447\u0435\u043d\u044b \u0432 \u0441\u043e\u0441\u0442\u0430\u0432 \u044f\u0434\u0440\u0430 Linux 5.17-rc. \u0412 \u043f\u0430\u043a\u0435\u0442 nftables \u0432\u0445\u043e\u0434\u044f\u0442 \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u044b \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u0433\u043e \u0444\u0438\u043b\u044c\u0442\u0440\u0430, \u0440\u0430\u0431\u043e\u0442\u0430\u044e\u0449\u0438\u0435 \u0432 \u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0441\u0442\u0432\u0435 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f, \u0432 \u0442\u043e \u0432\u0440\u0435\u043c\u044f \u043a\u0430\u043a \u043d\u0430 \u0443\u0440\u043e\u0432\u043d\u0435 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-103407","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.4 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d \u0432\u044b\u043f\u0443\u0441\u043a \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u0433\u043e \u0444\u0438\u043b\u044c\u0442\u0440\u0430 nftables 1.0.2, \u0443\u043d\u0438\u0444\u0438\u0446\u0438\u0440\u0443\u044e\u0449\u0435\u0433\u043e \u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441\u044b \u0444\u0438\u043b\u044c\u0442\u0440\u0430\u0446\u0438\u0438 \u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u0434\u043b\u044f IPv4, IPv6, ARP \u0438 \u0441\u0435\u0442\u0435\u0432\u044b\u0445 \u043c\u043e\u0441\u0442\u043e\u0432 (\u043d\u0430\u0446\u0435\u043b\u0435\u043d \u043d\u0430 \u0437\u0430\u043c\u0435\u043d\u0443 iptables, ip6table, arptables \u0438 ebtables).\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/sk\/blog\/news\/vypusk-paketnogo-filtra-nftables-1-0-2\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.4\" \/>\n\t\t<meta property=\"og:locale\" content=\"sk_SK\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0412\u044b\u043f\u0443\u0441\u043a \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u0433\u043e \u0444\u0438\u043b\u044c\u0442\u0440\u0430 nftables 1.0.2 | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d \u0432\u044b\u043f\u0443\u0441\u043a \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u0433\u043e \u0444\u0438\u043b\u044c\u0442\u0440\u0430 nftables 1.0.2, \u0443\u043d\u0438\u0444\u0438\u0446\u0438\u0440\u0443\u044e\u0449\u0435\u0433\u043e \u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441\u044b \u0444\u0438\u043b\u044c\u0442\u0440\u0430\u0446\u0438\u0438 \u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u0434\u043b\u044f IPv4, IPv6, ARP \u0438 \u0441\u0435\u0442\u0435\u0432\u044b\u0445 \u043c\u043e\u0441\u0442\u043e\u0432 (\u043d\u0430\u0446\u0435\u043b\u0435\u043d \u043d\u0430 \u0437\u0430\u043c\u0435\u043d\u0443 iptables, ip6table, arptables \u0438 ebtables).\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/sk\/blog\/news\/vypusk-paketnogo-filtra-nftables-1-0-2\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2022-02-22T01:36:42+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2022-02-22T01:36:42+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Vydanie bal\u00ed\u010dkov\u00e9ho filtra nftables 1.0.2 | ProHoster","description":"Bol vydan\u00fd bal\u00ed\u010dkov\u00fd filter nftables 1.0.2, ktor\u00fd unifikuje rozhrania filtr\u00e1cie paketov pre IPv4, IPv6, ARP a sie\u0165ov\u00e9 mosty (cielen\u00fd na nahradenie iptables, ip6tables, arptables a ebtables).","canonical_url":"https:\/\/prohoster.info\/sk\/blog\/news\/vypusk-paketnogo-filtra-nftables-1-0-2","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sk_SK","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412\u044b\u043f\u0443\u0441\u043a \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u0433\u043e \u0444\u0438\u043b\u044c\u0442\u0440\u0430 nftables 1.0.2 | ProHoster","og:description":"\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d \u0432\u044b\u043f\u0443\u0441\u043a \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u0433\u043e \u0444\u0438\u043b\u044c\u0442\u0440\u0430 nftables 1.0.2, \u0443\u043d\u0438\u0444\u0438\u0446\u0438\u0440\u0443\u044e\u0449\u0435\u0433\u043e \u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441\u044b \u0444\u0438\u043b\u044c\u0442\u0440\u0430\u0446\u0438\u0438 \u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u0434\u043b\u044f IPv4, IPv6, ARP \u0438 \u0441\u0435\u0442\u0435\u0432\u044b\u0445 \u043c\u043e\u0441\u0442\u043e\u0432 (\u043d\u0430\u0446\u0435\u043b\u0435\u043d \u043d\u0430 \u0437\u0430\u043c\u0435\u043d\u0443 iptables, ip6table, arptables \u0438 ebtables).","og:url":"https:\/\/prohoster.info\/sk\/blog\/news\/vypusk-paketnogo-filtra-nftables-1-0-2","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2022-02-22T01:36:42+00:00","article:modified_time":"2022-02-22T01:36:42+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"103407","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2022-02-22 01:37:39","updated":"2022-09-28 07:06:54","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/103407","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/comments?post=103407"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/103407\/revisions"}],"predecessor-version":[{"id":164194,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/103407\/revisions\/164194"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/media?parent=103407"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/categories?post=103407"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/tags?post=103407"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}